Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'd like to provide some background before I pose my question so please, bear with me.

I have come across Microsoft's Security Compliance Manager. It's rather new to me and as I understand so far, one can download EC (enterprise) or SSLF (specialized security, limited function) security "baseline" GPOs for implementation in Active Directory. The baselines are for XP, Win 7, Win 2k3, and 2k8.

GPOAccelerator can deploy or implement these baseline GPOs for a Domain or Locally.

I believe SCCM's DCM can compare GPOs that one has created against GPOs from the SCM?

And now for my question: Is there a tool to check GPOs like MBSA? Bonus: Is there any tool that will give a security rating for "missing" GPOs or "weak" GPOs?

share|improve this question
Wow. Too many acronyms for me. You lost me halfway, I'm afraid. – Martijn Heemels Oct 8 '10 at 20:26

Not sure what OS's you are actually running, but the Group Policy Diagnostic BPA for Server 2003 (here - might be what you are looking for. They also have a version that runs on XP.

I don't know if there is a tool yet for Server 08 and Vista and beyond.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.